Password generator
Strong, random passwords with real entropy shown.
- Truly random, not a pattern
- Entropy and crack time shown
- Nothing stored or sent
How to generate a password
- Choose password or passphrase mode and set the length.
- Pick which character sets to include.
- Click Generate, then copy the result.
How the character pool builds strength
Each character set you turn on adds to the pool a character can be picked from. A bigger pool means each character carries more entropy.
| Set | Characters | Pool size |
|---|---|---|
| Uppercase | A to Z | 26 |
| Lowercase | a to z | 26 |
| Numbers | 0 to 9 | 10 |
| Symbols | !@#$%^&*()-_=+[]{};:,.<>/? | 26 |
| All four combined | 88 |
With all 4 sets on, every extra character adds about 6.5 bits of entropy. Turning sets off shrinks the pool and the entropy per character, even at the same length.
Length versus strength, worked out
Using all 4 character sets (a pool of 88), here is roughly what different lengths reach:
| Length | Entropy | Strength shown |
|---|---|---|
| 8 | about 52 bits | Reasonable |
| 12 | about 77 bits | Strong |
| 16 | about 103 bits | Very strong |
| 20 | about 129 bits | Very strong |
The strength label and crack time on this page update from this same math the moment you change the length or sets, using an estimate of 10 billion guesses per second for the attacker.
Passphrase length versus strength
Passphrase mode picks each word from a list of 290 words, so every word adds about 8.2 bits. Adding a number at the end adds a further 3.3 bits.
| Words | Entropy | Strength shown |
|---|---|---|
| 3 | about 25 bits | Very weak |
| 5 | about 41 bits | Reasonable |
| 8 | about 65 bits | Strong |
| 10 | about 82 bits | Very strong |
5 words is the default because it balances strength with something you can still read back and type without much trouble. Go to 8 or more words for accounts that need very strong protection.
Password generator FAQ
Is this password sent to a server?
No. Every character is chosen by your browser's own random number generator, and the password never leaves your device.
What does the entropy number mean?
Entropy in bits measures how many guesses an attacker would need. Each extra bit doubles the guesses required, so 60 bits takes about a billion times longer to crack than 30 bits.
How is the crack time estimated?
It assumes an attacker trying 10 billion guesses per second, a realistic speed for offline attacks on a leaked password hash. Online logins with rate limits take far longer.
Should I use a passphrase instead?
Passphrases made of several random words are easier to type and remember, and can reach similar entropy to a shorter random password when you use enough words.
Why exclude look-alike characters?
Turning that on removes characters like l, 1, I, O and 0, which can be hard to tell apart when a password is read aloud or written down.
How long should a password be?
16 characters with all 4 character sets on gives about 103 bits of entropy, well into very strong. Do not go under 12 characters if you can help it, since shorter passwords fall into a range crackable within a realistic timeframe on leaked hashes.
What if a site will not accept symbols?
Turn off symbols and increase the length instead. A 20-character password using only letters and numbers still reaches a strong entropy level, since length matters more than which character sets you include.
Does excluding look-alike characters weaken the password?
Very slightly. It shrinks the character pool by up to 5 characters, which costs a small fraction of a bit of entropy per character, not enough to matter at normal lengths.
Should I store this password somewhere?
This tool does not save or remember what you generate, so copy it straight into a password manager or the account you are creating. Reusing the same password on more than one site is a bigger risk than almost any single password's strength.